Can I use Cyberlop with a CI system that has no ready-made snippet?

The short version

The Integrations page ships snippets for two code hosts. Neither is special. Each one makes the same two web requests, so you can copy the pattern into any pipeline tool that runs a shell step.

How it works in Cyberlop

1. Store two values as secrets in your CI system: CYBERLOP_URL (your app's base URL) and CYBERLOP_API_TOKEN (your personal API token).
2. Trigger. Send POST /api/ci/scan with an authorization: Bearer header and a JSON body holding profileId and, if you like, commitSha. The reply gives you a scanId.
3. Wait. Poll GET /api/ci/result/{scanId} until the reply says done is true. The shipped snippets poll every 30 seconds, up to 120 times.
4. Report. Read totalIssues and the findings list. Each finding has a severity, a title and a location. Print them to the job log.

The in-app documentation describes the same flow under CI/CD and automation. The scan runs with the token owner's permissions and group scope, so use a token whose owner can run that profile.

What to do next

• Copy a snippet as a starting point: how to copy the CI snippet.
• Learn the trigger call in launching a scan with the API.
• See the polling call in polling a scan result.

The snippets never fail your build. If you want a failing gate, you decide the rule in your own script, using the counts the result call returns. Our CI/CD integration tutorial walks through the whole setup, and the idea of gating a build explains the trade-off.

Related questions

• How do I copy the ready-made CI workflow for my code host?
• How do I launch a scan through the API?
• How do I check a CI-triggered scan's result through the API?
• Which secrets do I need to add to my repository for CI scans?
• Why did my CI job pass even though Cyberlop found critical issues?

Full tutorial

How to add security scanning to your CI/CD pipeline

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre